CVE-2026-88995 Overview
CVE-2026-88995 affects the Bookit — Booking & Appointment Calendar WordPress plugin in versions prior to 2.6.0.1. The plugin fails to restrict data returned by its availability-check endpoint. Unauthenticated attackers can query the endpoint and retrieve other customers' appointment records. Exposed fields include free-text booking comments and contact information.
The issue maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. It is reachable over the network without authentication or user interaction. The WPScan advisory tracks the flaw and confirms the fixed version.
Critical Impact
Unauthenticated remote attackers can enumerate customer appointment data, including personal contact details and free-text booking comments, from any affected Bookit installation.
Affected Products
- Bookit — Booking & Appointment Calendar WordPress plugin, all versions before 2.6.0.1
- WordPress sites exposing the plugin's public availability-check request
- Fixed in Bookit version 2.6.0.1
Discovery Timeline
- 2026-09-13 - CVE-2026-88995 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-88995
Vulnerability Analysis
The Bookit plugin exposes an availability-check request that clients use to determine open appointment slots. The server-side handler returns more data than the client requires. Instead of returning only availability state, it includes appointment records belonging to other customers.
Because the endpoint requires no authentication, any remote visitor can invoke it. An attacker who scripts repeated requests can enumerate the plugin's booking dataset. The disclosed fields include free-text comments customers submitted during booking and their supplied contact information such as names, phone numbers, and email addresses.
The exposure is limited to confidentiality; the vulnerability does not permit modification or destruction of appointment data. However, aggregated bookings can support downstream phishing, social engineering, and doxxing against the site's customer base.
Root Cause
The root cause is missing output filtering on the availability-check response handler. The endpoint returns full appointment objects rather than a minimal availability status. There is no authorization check to confirm the requester owns the returned records. This pattern is a classic [CWE-200] information exposure caused by over-permissive server responses.
Attack Vector
Exploitation requires only network access to the vulnerable WordPress site. An attacker issues a crafted availability-check request to the plugin's public endpoint and parses the JSON response for customer records. See the WPScan Vulnerability Report for endpoint specifics.
No verified public exploit code is available. The vulnerability mechanism is described in prose here rather than reproduced.
Detection Methods for CVE-2026-88995
Indicators of Compromise
- Repeated unauthenticated requests to the Bookit availability-check admin-ajax.php action or REST route from a single source IP
- Response payloads from the availability endpoint that contain customer names, emails, phone numbers, or free-text comments
- Anomalous outbound bandwidth from /wp-admin/admin-ajax.php responses tied to the Bookit plugin
Detection Strategies
- Inspect web server access logs for high-volume requests targeting Bookit availability endpoints from non-browser user agents
- Deploy a web application firewall rule that flags availability-check responses exceeding an expected size threshold
- Correlate scraping patterns using rate-based analytics on the Bookit AJAX action name
Monitoring Recommendations
- Enable verbose WordPress request logging for the Bookit plugin and forward logs to a central SIEM
- Alert on any single IP issuing more than a small burst of availability-check requests within a short window
- Review WordPress activity logs for unusual read patterns against booking data tables
How to Mitigate CVE-2026-88995
Immediate Actions Required
- Upgrade the Bookit — Booking & Appointment Calendar plugin to version 2.6.0.1 or later on all WordPress sites
- Audit prior availability-check response logs to estimate what customer data may have been disclosed
- Notify affected customers if evidence of scraping predates the patch, in line with applicable privacy regulations
Patch Information
The vendor released Bookit version 2.6.0.1, which restricts the data returned by the availability-check endpoint. Administrators should update through the WordPress plugin repository. Confirm the installed version under Plugins after updating. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily disable the Bookit plugin on public sites until the update to 2.6.0.1 is applied
- Place the availability-check endpoint behind a web application firewall rule that strips customer fields from responses
- Restrict access to the WordPress AJAX endpoint by IP where the booking widget is only used by internal staff
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
